Repository navigation
IdP-Initiated SAML to OIDC Bridge - Architecture Validation Request #44894
Unanswered
RichardSobreiro
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I'm trying to use Keycloak as a broker between Auth0 and Identity Service as an intermediary step for a full migration from Identity Service to Keycloak, as follows:
Auth0 (SAML IdP) - IdP-INITIATED SSO
↓ [SAML Response POST]
Keycloak (SAML SP, OIDC IdP)
↓ [User provisioning with custom attributes]
↓ [OIDC Authorization Code Flow]
IdentityServer (OIDC Client of Keycloak)
↓ [ExternalAuthController - receives Keycloak ID token, provisions local user]
↓ [Issues IdentityServer tokens]
SPA
↓ [Access API with IdentityServer tokens]
I'm not sure if Keycloak supports the scenario above: Keycloak as an SP using SAML SSO, brokering to Identity Service as an IdP as an OIDC SSO.
I've tried using the following request, having a registered Identity Provider with alias auth0 and a SAML Client with IDP-Initiated SSO URL name as "test-client":
curl --location 'http://localhost:7300/realms/[realm]/broker/auth0/endpoint/clients/test-client'
--header 'Content-Type: application/x-www-form-urlencoded'
--header 'Cookie: AUTH_SESSION_ID='
--data-urlencode 'SAMLResponse= '
No success.
The question is: is the architecture mentioned above something supported?
BTW, we are introducing Keycloak in the middle of Auth0 and Identity Service to offload the SAML SSO from Identity Service to Keycloak and get rid of some licenses.
All reactions